Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubisoft "Uplay" DRM exposed as rootkit

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 148 posts

Re: Ubisoft "Uplay" DRM exposed as rootkit

#12

Post by Foy »

Oh hell no. I can't believe this shit... and Tom Clancy's Ghost Recon: Future Soldier was such a good game too. T_T

Next time I want to play an Ubisoft game I'm just going to pirate it.

EDIT: I buy 99% of my video games through Steam, and when the games I get through Steam want to use their own launcher (play, windows live games, or EA's Origin, for example) I always get peeved.. to find out it allows arbitrary remote code execution is absolutely infuriating.

EDIT: Oh, btw, I'm using Opera 12.

EDIT: Protect yourself (in Opera, at least) by going to Settings -> Preferences(menu option) -> Advanced(Tab) -> Downloads(left menu bar) -> Search for "uplay" and delete the associated row.

Re: Ubisoft "Uplay" DRM exposed as rootkit

#13

Post by simias »

Paul_S wrote: post #9
kevingadd wrote: post #7

Why does Tavis Ormandy ( http://seclists.org/fulldisclosure/2012/Jul/375 ) keep putting fully usable proof of concept exploits out for widely deployed software without giving a vendor time to prepare a patch, or in this case, even notifying them? Off the top of my head, I remember he did this for the windows help center exploit and the java web start exploit. I can't understand why you would do this. You could at lea…

Because the company wasn't acting in good faith? IMHO they put that there on purpose and they deserve to be exposed as evil bastards that they are.

Do you have any evidence they put that here on purpose or are you just spreading rumors? It could as well be shoddy programming.

Re: Ubisoft "Uplay" DRM exposed as rootkit

#14

Post by SideburnsOfDoom »

simias wrote: post #10

I'm not sure if that's what the OP implied, but I'm not sure this was done on purpose. "Never attribute to malice that which is adequately explained by stupidity". Ubisoft is well know for their aggressive anti-pirating practices (cloud saves for instance), but that's just too idiotic. Here's taviso's mail on seclists: http://seclists.org/fulldisclosure/2012/Jul/375 I hope ubisoft reacts quickly.

Stupidity can also be criminal.

Re: Ubisoft "Uplay" DRM exposed as rootkit

#15

Post by ewillbefull »

Paul_S wrote: post #9
kevingadd wrote: post #7

Why does Tavis Ormandy ( http://seclists.org/fulldisclosure/2012/Jul/375 ) keep putting fully usable proof of concept exploits out for widely deployed software without giving a vendor time to prepare a patch, or in this case, even notifying them? Off the top of my head, I remember he did this for the windows help center exploit and the java web start exploit. I can't understand why you would do this. You could at lea…

Because the company wasn't acting in good faith? IMHO they put that there on purpose and they deserve to be exposed as evil bastards that they are.

What makes you believe they put it there on purpose? It appears to have a genuine (if insecure) purpose. Even the researcher's message on seclists implies he thought of it as a bug.

Re: Ubisoft "Uplay" DRM exposed as rootkit

#18

Post by rix0r »

paddington wrote: post #4

I'm curious, could it be possible to implement a simple SMB listener in javascript and then send send "\\ \my_virus.exe\" (encoded in base64) as orbit_exe_path?

You'd have to implement a TCP server listening on a privileged port (< 1024). Surely no browser would allow this.

Re: Ubisoft "Uplay" DRM exposed as rootkit

#19

Post by killyourheros »

kevingadd wrote: post #7

Why does Tavis Ormandy ( http://seclists.org/fulldisclosure/2012/Jul/375 ) keep putting fully usable proof of concept exploits out for widely deployed software without giving a vendor time to prepare a patch, or in this case, even notifying them? Off the top of my head, I remember he did this for the windows help center exploit and the java web start exploit. I can't understand why you would do this. You could at lea…

Very few comapnies will pay for this type of exploit, even fewer will offer a thanks. It's easier to get them fixed this way.
Post reply on HN